Generator · RFC 8461 · RFC 8460

MTA-STS generator

MTA-STS asks the servers that send you mail to deliver only over TLS with a valid certificate, and only to the MX hosts you list. Pick the mode and the hosts: you get the policy file, the two DNS records and a check against the real domain.

01The domain

Domain

02Mode

mode: noneWithdraws an earlier policy, before dropping MTA-STS.
mode: testingSenders check and report, but deliver anyway. The recommended start.
mode: enforceSenders do not deliver to hosts without valid TLS or not listed.

03MX hosts

mx: patterns, one per line

The exact names of the MX hosts, or *.example.com, which covers one level only: mail.example.com, but not example.com nor a.b.example.com (RFC 8461 section 4.1).

How long senders cache the policy (max_age)

RFC 8461 expects weeks or more: a policy cached for long cannot easily be bypassed. In testing mode, one day lets you correct quickly.

04TLS reports Where reports go (rua)

E-mail addresses or an https:// URL, one per line. Senders report daily which TLS deliveries failed. Read them with the TLS report analyzer.

Live preview

mta-sts.example.com/.well-known/mta-sts.txt

version: STSv1
mode: testing
max_age: 604800

_smtp._tls.example.comTXT

no reports

Protection: testing

From withdrawal (none), through testing, to enforcement (enforce).

The full check, with DNS, runs when you generate.

Moving to MTA-STS without losing mail

Publish the policy in testing mode, together with TLS-RPT: nothing is blocked, but senders report what would have failed.
Read the daily TLS reports with the TLS report analyzer and fix what shows up: expired certificates, wrong names, unlisted MX hosts.
When the reports show zero failures, move to enforce and raise max_age to a few weeks.

MTA-STS in brief

What it solves
Without MTA-STS, TLS between servers is opportunistic: someone on the path can strip the STARTTLS offer and the mail leaves unencrypted. An enforce policy asks senders to deliver only over valid TLS, only to the listed MX hosts.
What it is made of
A file served over HTTPS at mta-sts. + domain and a TXT record _mta-sts with an id. Senders check the id and fetch the file only when it changes (RFC 8461 section 3).
The mx patterns
Every MX host must match a pattern and present a valid certificate for its name. *.example.com covers exactly one level (section 4.1).
Why TLS-RPT
The _smtp._tls record (RFC 8460) tells senders where to send a daily report of failed TLS deliveries. It is the only way to see problems before enforce.

Sources: RFC 8461 · RFC 8460

MTA-STS and TLS-RPT: enforce TLS without losing mail